ECtHR rules on breach of Article 8 due to indefinite data retention of a substitute administrative penalty

In its decision in Tonchev v Bulgaria (Application no. 40519/15) earlier this month the ECtHR held that the Bulgarian Government’s indefinite retention of data about the applicant’s substitute administrative penalty (broadly equivalent to a Fixed Penalty Notice)  (“the penalty”) was not in accordance with the law and therefore a violation of the applicant’s ECHR Article 8 rights. The decision highlights the importance of absolute clarity in the rules and regulations about how criminal record data will be processed, and suggests that opposing views between a Government and its national data protection authority may of itself  indicate of itself a lack of clarity rendering it impossible to say the Article 8 interference is “in accordance with the law” for the purposes of Article 8(2).

The applicant, a former prison officer, received the penalty in 2002 for driving under the influence of alcohol. As required by domestic regulations, a record card for the penalty was drawn up and stored by the criminal records bureau. Under the same regulations the record card was to be destroyed 5 years after the penalty became final. In 2012 – 10 years later –  the applicant applied for a Ministry of Justice role and failed the vetting for the role because the penalty was disclosed. The applicant was then dismissed from his role as a prison officer because the post was incompatible with the penalty.

The applicant complained to the ECtHR about, inter alia, the Government’s ongoing retention of the penalty data. There was agreement that the processing of data about criminal convictions is an interference with data subjects’ private lives (regardless of actual consequences) and therefore the only issue was whether that interference was justified.

The court held the interference was not justified as it could not be construed as “in accordance with the law” . The court observed that for the processing of criminal record data:

“it is essential to have clear and detailed rules governing the scope and application of such measures, and minimum safeguards concerning, among other things, duration, storage, usage, access of third parties, and the procedures for preserving the integrity and confidentiality of the data and their destruction”.

The court held there were significant ambiguities in the domestic legislation as to whether the penalty data must be destroyed at the same time as the record card, or whether the penalty data itself could be retained indefinitely, and attributed particular weight to the fact of the opposing views of the Bulgarian Ministry of Justice and the Bulgarian data protection authority as to the correct position, noting:

“Regulations which are vague enough to cause confusion even among the national authorities in charge of their interpretation and application can hardly be seen as sufficiently foreseeable”.

In light of the court’s conclusion that the interference was not in accordance with the law, the majority assessed there was no need to determine whether the retention was “necessary in a democratic society” to achieve one of the Article 8(2) aims. Interestingly, in a concurring judgment on different grounds Judge Pavli was critical of the majority for approaching the case as a question of whether there was a lack of foreseeability in the domestic regulations, suggesting they had avoided a proper analysis by taking that approach. In Judge Pavli’s opinion the Bulgarian government had failed to advance a compelling justification for the indefinite retention and processing of the penalty data.

---

Authors

Cicely Hayward

Call 2009

Other articles in this edition

New health and social care guidance from the Information Commissioner

---

Information Commissioner loses enforcement notice appeal on Experian’s transparency

---